2015 Trax, Colorado, Encore Onstar module K73 physical disassembly

[04colyZQ8]

This module definitely has some tightly run PCB traces. I do not see any EEPROM so it, must use the MCU virtual EEPROM to store a few things. I do not see any VIN reported by any DID.

When I hooked this up just power, ground, IGN and CAN lo pin 1, my doors unlocked and locked via my chevy app.
Which tells us a lot, Onstar does not care what other modules are present to authenticate a SMS/web socket session. And I still don't think this module is reporting any VIN. I think that is done at setup on there end, and they link the IMEI number and user code from the module to a VIN, polled from one or more modules during setup. That or perhaps the internal ESIM phone number is linked to the VIN at production build?

Also, my logs are definitely not working then because I get no traffic from the Onstar module at address 97, or 024D (resp 064D). So my low speed logging needs some work maybe extended frames are not working?


MC1MX6S1AVM08AB MCU ARM9
NCV7356G CAN transceiver

FCC report has some photos and info
https://fcc.report/FCC-ID/BEJLTTC10F/ FCC

Hello SIM card holder and ESIM missing from the PCB (FCC has early prototype with plastic SIM). Probably just removing the ESIM and soldering on a SIM holder
would work. Then I don't have to pay data to GM? But the phone number would not match OnStar .

I do not see any other simple IC to store VIN or anything. Can some ESIMs have a EEPROM to store anything like that? This ESIM I have never seen before?

IMG-20250827-WA0004.jpg

Can't find any info for it.

FCC Test SIM plastic below

IMG-20250827-WA0017.jpg

IMG-20250827-WA0018.jpg

IMG-20250827-WA0015.jpg

IMG-20250827-WA0006.jpg

IMG-20250827-WA0016.jpg

IMG-20250827-WA0017.jpg

Code: Select all

ssecuhn = 23261543
vin = 3GNCJRSB5FL163579
snoet = 
vmecuhn = 0
ssecusvn = 0
ecu_adr = 97
num_part = 1
numcms = 2
blocklen = 0
disp_type = 1
protocol = 3
swcompat_id = ffffffff
diagdata_id = 65535
shopcode = 99999888888
progdate = FFFFFFFF
pinnum = 68
numseeds = 1
event_type = 1
devicetype = J2534
seed = 0000
sps_id = a7
chksum = 0
table_len = 0
nav_info = FFFFFFFF, FFFFFFFF, FFFFFFFF, FFFFFFFF, FFFFFFFF
reserved = -1
post_prog_instructions = 
SecCodeVeh = 8111

[04colyZQ8]

Used some off the shelf 4g antennas for routers and got signal on the bench.. had to solder on the leads to the pcb.

Now have only the bcm, onstar and pcm on the bench send unlock with app I hear the door lock relay inside the bcm click!

Only gm los speed is hooked up from the onstar to bcm. It does have high speed but I disconnected it.

[04colyZQ8]

IMG_2384.jpeg

IMG_2385.jpeg

IMG_2387.jpeg

Looks like a rats nest but it works .. my terrible bench setup …

[antus]

Thinking about this, it'd make sense they don't use vin as in a lot of cases VIN is programmable as you know. I think the ticket is on the labels on the side of the module. You have STID, IMEI, IMSI and ICCID. I'd guess it's 1 or more of those. STID could be onSTarID STarID? or something like that... so it kinda feels like that'd be it. But they could use IMEI as that is globally unique and associated with the hardware. Is the GSM a module that can be removed? If it can be, it'd be less likely for them to use that as it'd be swappable and they probably don't want that. They're also a car company so they not want to use identifiers from outside. I would be surprised if its not STID and not in the CPUs internal EEPOM.

[04colyZQ8]

Thinking about this, it'd make sense they don't use vin as in a lot of cases VIN is programmable as you know. I think the ticket is on the labels on the side of the module. You have STID, IMEI, IMSI and ICCID. I'd guess it's 1 or more of those. STID could be onSTarID STarID? or something like that... so it kinda feels like that'd be it. But they could use IMEI as that is globally unique and associated with the hardware. Is the GSM a module that can be removed? If it can be, it'd be less likely for them to use that as it'd be swappable and they probably don't want that. They're also a car company so they not want to use identifiers from outside. I would be surprised if its not STID and not in the CPUs internal EEPOM.

Well DID 08 I think gives the customer ID number , which I think maybe all they use? It’s 06AXX on mine tried 3B write no dice. Probably needs an unlock?

Controller reports a seed ..

But programing is only done via node 35 write ! And they don’t unlock it! So idk how to find the key? What aligro would it be?